client-certificate-auth 1.3.4 → 1.3.6

package/lib/clientCertificateAuth.cjs

@@ -19,6 +19,19 @@ async function loadModule() {
     return _default;
 }
 
+/**
+ * Duck-typed thenable check per Promises/A+: an object or function with
+ * a callable `.then` method. Matches the set of values `Promise.resolve`
+ * natively adopts as thenables.
+ * @param {unknown} value
+ * @returns {boolean}
+ */
+function isThenable(value) {
+    return value !== null
+        && (typeof value === 'object' || typeof value === 'function')
+        && typeof value.then === 'function';
+}
+
 /**
  * Options not supported by the sync CJS wrapper.
  * These require the ESM module's async header parsing.
@@ -72,8 +85,8 @@ function clientCertificateAuth(callback, options = {}) {
         queueMicrotask(() => {
             try {
                 const result = hook(...args);
-                if (result instanceof Promise) {
-                    result.catch(err => console.error('client-certificate-auth: hook error:', err));
+                if (isThenable(result)) {
+                    Promise.resolve(result).catch(err => console.error('client-certificate-auth: hook error:', err));
                 }
             } catch (err) {
                 console.error('client-certificate-auth: hook error:', err);
@@ -85,8 +98,7 @@ function clientCertificateAuth(callback, options = {}) {
         // Ensure that the certificate was validated at the protocol level
         if (!req.socket?.authorized) {
             safeCallHook(onRejected, null, req, 'socket_not_authorized');
-            const authError = req.socket?.authorizationError || 'unknown';
-            const e = new Error(`Unauthorized: Client certificate required (${authError})`);
+            const e = new Error('Unauthorized: Client certificate required');
             e.status = 401;
             return next(e);
         }
@@ -119,8 +131,8 @@ function clientCertificateAuth(callback, options = {}) {
 
         try {
             const result = callback(cert, req);
-            if (result instanceof Promise) {
-                result.then(doneAuthorizing).catch((err) => {
+            if (isThenable(result)) {
+                Promise.resolve(result).then(doneAuthorizing).catch((err) => {
                     safeCallHook(onRejected, cert, req, err.message || 'callback_threw');
                     if (err.status === undefined) {
                         err.status = 401;

package/lib/clientCertificateAuth.js

@@ -7,6 +7,19 @@
 
 import { extractClientCertificate } from './extractor.js';
 
+/**
+ * Duck-typed thenable check per Promises/A+: an object or function with
+ * a callable `.then` method. Matches the set of values `Promise.resolve`
+ * natively adopts as thenables.
+ * @param {unknown} value
+ * @returns {boolean}
+ */
+function isThenable(value) {
+  return value !== null
+    && (typeof value === 'object' || typeof value === 'function')
+    && typeof /** @type {{then?: unknown}} */ (value).then === 'function';
+}
+
 /**
  * @typedef {import('http').IncomingMessage & { secure?: boolean; socket: import('tls').TLSSocket & { authorized?: boolean; authorizationError?: string }; clientCertificate?: import('tls').PeerCertificate }} ClientCertRequest
  * @typedef {import('http').ServerResponse & { redirect: (statusOrUrl: number | string, url?: string) => void }} ClientCertResponse
@@ -107,8 +120,8 @@ export default function clientCertificateAuth(callback, options = {}) {
     queueMicrotask(() => {
       try {
         const result = hook(...args);
-        if (result instanceof Promise) {
-          result.catch(err => console.error('client-certificate-auth: hook error:', err));
+        if (isThenable(result)) {
+          Promise.resolve(result).catch(err => console.error('client-certificate-auth: hook error:', err));
         }
       } catch (err) {
         console.error('client-certificate-auth: hook error:', err);
@@ -136,19 +149,15 @@ export default function clientCertificateAuth(callback, options = {}) {
       let statusCode = 401;
 
       switch (result.reason) {
-        case 'verification_header_mismatch': {
-          const verifyStatus = req.headers[verifyHeader.toLowerCase()];
-          errorMessage = `Unauthorized: Certificate verification failed (${verifyStatus || 'header missing'})`;
+        case 'verification_header_mismatch':
+          errorMessage = 'Unauthorized: Certificate verification failed';
           break;
-        }
         case 'header_missing_or_malformed':
           errorMessage = 'Unauthorized: Client certificate header missing or malformed';
           break;
-        case 'socket_not_authorized': {
-          const authError = req.socket?.authorizationError || 'unknown';
-          errorMessage = `Unauthorized: Client certificate required (${authError})`;
+        case 'socket_not_authorized':
+          errorMessage = 'Unauthorized: Client certificate required';
           break;
-        }
         case 'certificate_not_retrievable':
           errorMessage = 'Client certificate was authenticated but certificate information could not be retrieved.';
           statusCode = 500;
@@ -181,8 +190,8 @@ export default function clientCertificateAuth(callback, options = {}) {
 
     try {
       const callbackResult = callback(cert, req);
-      if (callbackResult instanceof Promise) {
-        callbackResult.then(doneAuthorizing).catch((err) => {
+      if (isThenable(callbackResult)) {
+        Promise.resolve(callbackResult).then(doneAuthorizing).catch((err) => {
           safeCallHook(onRejected, cert, req, err.message || 'callback_threw');
           if (err.status === undefined) {
             err.status = 401;

package/lib/helpers.js

@@ -38,7 +38,8 @@ export function allowCN(names) {
  * Create a validation callback that allows certificates with matching fingerprints.
  * Supports SHA-1 fingerprints (compared against cert.fingerprint) and SHA-256
  * fingerprints with "SHA256:" prefix (compared against cert.fingerprint256).
- * Fingerprints without a prefix are treated as SHA-1.
+ * Fingerprints without a prefix are treated as SHA-1. Hex inputs are
+ * normalized: case and colon delimiters are ignored on both sides.
  *
  * @param {string[]} fingerprints - Allowed fingerprints
  * @returns {ValidationCallback}
@@ -46,28 +47,30 @@ export function allowCN(names) {
  * @example
  * app.use(clientCertificateAuth(allowFingerprints([
  *   'SHA256:AB:CD:EF:...',  // matched against cert.fingerprint256
- *   'AB:CD:EF:...'          // matched against cert.fingerprint (SHA-1)
+ *   'AB:CD:EF:...',         // colon-delimited, matched against cert.fingerprint
+ *   'ABCDEF...'             // contiguous hex also matches cert.fingerprint
  * ])));
  */
 export function allowFingerprints(fingerprints) {
+    const normalize = (fp) => fp.toUpperCase().replace(/:/g, '');
     const sha256Allowed = new Set();
     const sha1Allowed = new Set();
 
     for (const fp of fingerprints) {
         const upper = fp.toUpperCase();
         if (upper.startsWith('SHA256:')) {
-            sha256Allowed.add(upper.slice(7));
+            sha256Allowed.add(normalize(upper.slice(7)));
         } else {
-            sha1Allowed.add(upper);
+            sha1Allowed.add(normalize(upper));
         }
     }
 
     return (cert) => {
         if (sha1Allowed.size > 0 && cert.fingerprint) {
-            if (sha1Allowed.has(cert.fingerprint.toUpperCase())) {return true;}
+            if (sha1Allowed.has(normalize(cert.fingerprint))) {return true;}
         }
         if (sha256Allowed.size > 0 && cert.fingerprint256) {
-            if (sha256Allowed.has(cert.fingerprint256.toUpperCase())) {return true;}
+            if (sha256Allowed.has(normalize(cert.fingerprint256))) {return true;}
         }
         return false;
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "client-certificate-auth",
-  "version": "1.3.4",
+  "version": "1.3.6",
   "description": "Express/Connect middleware for mTLS client certificate authentication with reverse proxy support (AWS ALB, Envoy, Cloudflare, Traefik)",
   "homepage": "https://github.com/tgies/client-certificate-auth",
   "bugs": {
@@ -72,6 +72,7 @@
     "node": ">= 20"
   },
   "devDependencies": {
+    "@arethetypeswrong/cli": "^0.18.2",
     "@commitlint/cli": "^20.4.3",
     "@commitlint/config-conventional": "^20.5.0",
     "@stryker-mutator/core": "^9.6.0",
@@ -142,5 +143,8 @@
     "lib/**/*.cjs",
     "lib/**/*.d.ts",
     "lib/**/*.d.cts"
-  ]
+  ],
+  "overrides": {
+    "fflate": "0.8.2"
+  }
 }